rhadamanthys | a8b0aa62097048a307b1c77b86bdeb8943fdaa0ec955bb5d4b63671a758c9655

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 06:05

Target

test.exe
Size

355KB
MD5

b8e420187ad6ec1fb0a8ca7068e5a77c
SHA1

22d7ca966bb5ba798045d30911a618bbe6c07e13
SHA256

a8b0aa62097048a307b1c77b86bdeb8943fdaa0ec955bb5d4b63671a758c9655
SHA512

06490ab1f07be2f94cc5444636718b83a79d172f5f8b8bbea900982065211e0aa64f5fdc3873c25867dfc0c2d39f8086e85973c01a61e60ac5ef21a61de3677b
SSDEEP

6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqysb:gf2R/EEkCQFYDwRqd

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

test.exe

description pid process target process

PID 2784 created 1204 2784 test.exe Explorer.EXE
Deletes itself 1 IoCs

Processes:

dialer.exe

pid process

2976 dialer.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

test.exedialer.exe

pid process

2784 test.exe
2784 test.exe
2976 dialer.exe
2976 dialer.exe
2976 dialer.exe
2976 dialer.exe

description	pid	process	target process
PID 2784 created 1204	2784	test.exe	Explorer.EXE

pid	process
2976	dialer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

test.exe

description	pid	process	target process
PID 2784 wrote to memory of 2976	2784	test.exe	dialer.exe
PID 2784 wrote to memory of 2976	2784	test.exe	dialer.exe
PID 2784 wrote to memory of 2976	2784	test.exe	dialer.exe
PID 2784 wrote to memory of 2976	2784	test.exe	dialer.exe
PID 2784 wrote to memory of 2976	2784	test.exe	dialer.exe
PID 2784 wrote to memory of 2976	2784	test.exe	dialer.exe

memory/2784-9-0x0000000000CF0000-0x0000000000D5D000-memory.dmp

Filesize
436KB

Download
memory/2784-7-0x0000000076C30000-0x0000000076C77000-memory.dmp

Filesize
284KB

Download
memory/2784-2-0x0000000003290000-0x0000000003690000-memory.dmp

Filesize
4.0MB

Download
memory/2784-3-0x0000000003290000-0x0000000003690000-memory.dmp

Filesize
4.0MB

Download
memory/2784-0-0x0000000000CF0000-0x0000000000D5D000-memory.dmp

Filesize
436KB

Download
memory/2784-5-0x0000000003290000-0x0000000003690000-memory.dmp

Filesize
4.0MB

Download
memory/2784-1-0x0000000003290000-0x0000000003690000-memory.dmp

Filesize
4.0MB

Download
memory/2784-4-0x0000000077160000-0x0000000077309000-memory.dmp

Filesize
1.7MB

Download
memory/2976-8-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2976-12-0x0000000001AD0000-0x0000000001ED0000-memory.dmp

Filesize
4.0MB

Download
memory/2976-11-0x0000000001AD0000-0x0000000001ED0000-memory.dmp

Filesize
4.0MB

Download
memory/2976-13-0x0000000077160000-0x0000000077309000-memory.dmp

Filesize
1.7MB

Download
memory/2976-14-0x0000000001AD0000-0x0000000001ED0000-memory.dmp

Filesize
4.0MB

Download
memory/2976-17-0x0000000077160000-0x0000000077309000-memory.dmp

Filesize
1.7MB

Download
memory/2976-16-0x0000000076C30000-0x0000000076C77000-memory.dmp

Filesize
284KB

Download
memory/2976-18-0x0000000001AD0000-0x0000000001ED0000-memory.dmp

Filesize
4.0MB

Download